00fd2efe7e59af1a6d9909bd4acfd7e08a3f5be6f2eb2c711afd12645e8e6abb

Analysis

max time kernel
123s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2023, 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DOCUMENTO_NOTIFICACION_VINCULACION_PROCESO_ADELANTADOR_SECRETARIA_DE_SALUD_TURBO_POR_IRREGULARIDADES.rar
Size

359KB
MD5

aeff13ad45fc317d5b4ecb6cf19f6b9c
SHA1

b21a0b932f17c4e111d333682d3f750199beb584
SHA256

00fd2efe7e59af1a6d9909bd4acfd7e08a3f5be6f2eb2c711afd12645e8e6abb
SHA512

ae8a1cc8dcf1ff9cc0851e7c29fade369a84b43372b7f32188f1d49f9ecb773b4605fc6a129bac6890da1046d8976ebff7df0607aae4c5401046f76dec0271c4
SSDEEP

6144:u/9v/FFgh/rrNf1DlzpSzFqtKHd4NMTj/KuUvU0OwZYqPHLSSaJbK9ZGVZICGgnV:kCj59DJpmqtS42TrsOwuSaJWDGV4bA

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1496	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1900	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DOCUMENTO_NOTIFICACION_VINCULACION_PROCESO_ADELANTADOR_SECRETARIA_DE_SALUD_TURBO_POR_IRREGULARIDADES.rar
1⤵
- Modifies registry class
PID:4476

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1900

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1496-0-0x000001FA67340000-0x000001FA67350000-memory.dmp

Filesize
64KB

Download
memory/1496-16-0x000001FA67440000-0x000001FA67450000-memory.dmp

Filesize
64KB

Download
memory/1496-32-0x000001FA6F9F0000-0x000001FA6F9F1000-memory.dmp

Filesize
4KB

Download
memory/1496-33-0x000001FA6FA20000-0x000001FA6FA21000-memory.dmp

Filesize
4KB

Download
memory/1496-34-0x000001FA6FA20000-0x000001FA6FA21000-memory.dmp

Filesize
4KB

Download
memory/1496-35-0x000001FA6FA20000-0x000001FA6FA21000-memory.dmp

Filesize
4KB

Download
memory/1496-36-0x000001FA6FA20000-0x000001FA6FA21000-memory.dmp

Filesize
4KB

Download
memory/1496-37-0x000001FA6FA20000-0x000001FA6FA21000-memory.dmp

Filesize
4KB

Download
memory/1496-38-0x000001FA6FA20000-0x000001FA6FA21000-memory.dmp

Filesize
4KB

Download
memory/1496-39-0x000001FA6FA20000-0x000001FA6FA21000-memory.dmp

Filesize
4KB

Download
memory/1496-40-0x000001FA6FA20000-0x000001FA6FA21000-memory.dmp

Filesize
4KB

Download
memory/1496-41-0x000001FA6FA20000-0x000001FA6FA21000-memory.dmp

Filesize
4KB

Download
memory/1496-42-0x000001FA6FA20000-0x000001FA6FA21000-memory.dmp

Filesize
4KB

Download
memory/1496-43-0x000001FA6F640000-0x000001FA6F641000-memory.dmp

Filesize
4KB

Download
memory/1496-44-0x000001FA6F630000-0x000001FA6F631000-memory.dmp

Filesize
4KB

Download
memory/1496-46-0x000001FA6F640000-0x000001FA6F641000-memory.dmp

Filesize
4KB

Download
memory/1496-49-0x000001FA6F630000-0x000001FA6F631000-memory.dmp

Filesize
4KB

Download
memory/1496-52-0x000001FA6F570000-0x000001FA6F571000-memory.dmp

Filesize
4KB

Download
memory/1496-64-0x000001FA6F770000-0x000001FA6F771000-memory.dmp

Filesize
4KB

Download
memory/1496-66-0x000001FA6F780000-0x000001FA6F781000-memory.dmp

Filesize
4KB

Download
memory/1496-67-0x000001FA6F780000-0x000001FA6F781000-memory.dmp

Filesize
4KB

Download
memory/1496-68-0x000001FA6F890000-0x000001FA6F891000-memory.dmp

Filesize
4KB

Download